Which of the following is an example of a service commonly hosted in a demilitarized zone (DMZ)?

A demilitarized zone (DMZ) is a perimeter network segment that is logically placed between an organization's internal private network and the external public network (the internet). Its purpose is to host services that need to be accessible to the public, such as a company's public website. By placing the web server in the DMZ, it remains accessible from the internet but is isolated from the secure internal network. If the web server is compromised, the attacker is contained within the DMZ, preventing direct access to sensitive internal systems. This architectural pattern is a fundamental security practice for protecting internal assets.

A. A database server storing sensitive customer information should be located in the highly secured internal network, not the DMZ, to protect it from direct external threats.

B. An internal file-sharing server is intended for employee use only and should reside exclusively on the trusted internal network, not exposed in a semi-trusted zone like the DMZ.

C. A backup server contains critical and often sensitive recovery data; it must be protected within the most secure network segment, far from public-facing zones like the DMZ.

---

1. National Institute of Standards and Technology (NIST). (2009). Special Publication 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy.

Reference: Section 4.3.3, "Demilitarized Zones (DMZs)," page 4-7.

Quote/Content: The document states, "The systems that are most commonly placed in DMZs are Web servers, mail servers, remote access servers, and DNS servers... By placing a publicly accessible server in a DMZ, an organization can provide services to the Internet while protecting its internal network." This directly supports placing a public web server in the DMZ.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Reference: Chapter 8, Section 8.6.2, "Firewalls and Demilitarized Zones (DMZs)."

Content: This standard university textbook explains that organizations run publicly accessible servers like web and mail servers in a DMZ. It details how the DMZ architecture uses firewalls to prevent traffic from the internet from reaching the internal network, except for specific, controlled access to the DMZ servers.

3. Purdue University. (n.d.). Information Security Policy (VII.B.2) - Standard for Demilitarized Zone (DMZ) Implementation.

Reference: Section "Standard."

Content: The university standard specifies that "Any host system that provides services to the general public over the Internet must be placed in a DMZ." It explicitly lists "Public Web servers" as a primary example of a service that must be located in a DMZ.